$300k for Cracking Telegram Encryption • Hacker News Board

Re: $300k for Cracking Telegram Encryption

#91

Post by owenmarshall » Tue, Nov 04, 2014, 9:40 PM UTC

tptacek wrote: post #89

owenmarshall wrote: post #88

Earlier quoted context omitted.

> Let me put it this way - name a couple of open design issues with the current Telegram protocol. https://core.telegram.org/img/mtproto_encryption1.png The use of encrypt and MAC is the one that should jump out at even a crypto neophyte. There are some nice proofs around this[1] that I've read before. The important one is that encrypt then MAC guarantees INT-CTXT: it's computationally infeasible to produce a ciphert…

What actual MAC is that?

What actual MAC is what?

Sorry, I'm a bit confused by the question :)

Re: $300k for Cracking Telegram Encryption

#92

Post by tptacek » Tue, Nov 04, 2014, 9:50 PM UTC

owenmarshall wrote: post #91

tptacek wrote: post #89

Earlier quoted context omitted.

What actual MAC is that?

What actual MAC is what? Sorry, I'm a bit confused by the question :)

It's been awhile since I looked at anything in Telegram and I forget what MAC they use. That diagram makes it look like instead of a MAC, they're using a simple digest of the message --- which is not a MAC.

Re: $300k for Cracking Telegram Encryption

#93

Post by owenmarshall » Tue, Nov 04, 2014, 10:31 PM UTC

tptacek wrote: post #92

owenmarshall wrote: post #91

Earlier quoted context omitted.

What actual MAC is what? Sorry, I'm a bit confused by the question :)

It's been awhile since I looked at anything in Telegram and I forget what MAC they use. That diagram makes it look like instead of a MAC, they're using a simple digest of the message --- which is not a MAC.

Heh. I just looked again and had misread their specs: I thought the shared secret went into their SHA-1. You are correct, they just take a digest.

So I can make any message look OK just by hashing the plaintext. Heh. Wonder what that KDF looks like...

Re: $300k for Cracking Telegram Encryption

#94

Post by pbsd » Wed, Nov 05, 2014, 7:01 AM UTC

raverbashing wrote: post #55

tptacek wrote: post #52

Earlier quoted context omitted.

It guaranteed payment . It didn't try to prove a negative. It started from the presumption that there would be solid critiques.

How many comments were received/payed? There's an undated article https://www.schneier.com/twofish-contest.html pointing to a dead link

In the context of a crypto competition that sort of bounty is a way to try to get more attention to your design, therefore making your candidate more likely to be selected. Many designs are rejected due to lack of analysis at the time of the selection process. It's better to pick a well-analyzed primitive than a not-so-well analyzed one that looks more solid but is more of a gamble.